The invention relates to a method and a system for controlling platform doors which are arranged at a distance from one another which corresponds to the distance between train doors of a train to be entered from the platform.
A method or a system such as this is installed in particular on frequently used platforms and in train stations with driverless vehicles. In this case, doors are installed on the platform side and prevent passengers from stepping onto the tracks when there is no train at the platform. After a train has entered, the doors are opened at the same time as the train doors, and are closed again before the train departs. The function therefore corresponds, so to speak, to the function of an inner and outer elevator door.
The functions of the doors which are used in this case can be subdivided into safety-relevant functions and non-safety-relevant functions. For example, a locking function of the door, which prevents the door from being opened when this is not intended and when there is no train at the platform, represents a safety function while, for example, the provision of a specific movement curve during opening of the door merely contributes to speeding up the processes, and could therefore be referred to as a convenience function. In addition, for example, an unintended attempt by the door drive, which could be caused by a malfunction in it, does not represent a safety risk as long as an additional safety function—such as the lock described above—prevents the door from actually being opened.
In the case of elevator doors, the safety-relevant and non-safety-relevant functions are advantageously subdivided such that the drive control or the converter for the door motor has to provide only a small number of safety functions—such as limiting the force while closing.
However, when doors are used on platforms, it cannot be assumed, as in the case of elevators, that the safe state of the door is the closed state because:
1. elevators in tall buildings are generally of redundant design, but this cannot be done with platforms because of the additional investment required for this purpose,
2. staircases are normally also provided as a redundancy for elevators, for fire protection reasons, and
3. the capability to unlock a platform door by hand (mechanically), as in the case of an elevator, results in a platform failure until the door is serviced/brought back into use again.
When an elevator fails, the building in its entirety can still be used, although possibly with restricted performance. When a platform door fails, a relevant platform is also still ready for use. In contrast, if a platform fails (at least in subway operation), train operation will in general be adversely affected.
To this extent, it is worthwhile considering the availability of individual components, in addition to distinguishing between safety-relevant and non-safety-relevant functions. A component or function may be regarded as a high-availability component or function if the intended purpose of the function or the function of the component is still ensured even after failure of an individual component or a part thereof. A system can be considered to have high availability if a single failure of a component in the system does not prevent the overall operation of the system.
The provision of the safety-relevant functions can be implemented, for example, by suitable redundancies or other measures (for example also mechanical measures), such that a failure of single components does not lead to safety-critical states. This could be implemented, for example, by the controller itself (CPU), the transmission media for the control signals (for example PROFIBUS/PROFINET/individual I/O signals) and the actuators (for example locks on each door) being of redundant design.
“Convenience functions” can also be implemented without redundancy, since a failure of functions such as these does not directly lead to unsafe states. At first sight, it is therefore sufficient to design the transmission media and the actuators in a non-redundant form. However, in this case, all the platform doors will actually fail in the event of a defect, for example of the transmission medium.
However, a failure such as this can also indirectly lead to unsafe states—such as panic breaking out in an overcrowded subway station. Furthermore, more stringent availability requirements may demand that such a total failure of the platform doors be avoided, because of lack of redundancy in train stations (since platforms are generally not available in a redundant form).